Secure gitea-runner: remove tracked secrets, use SSH for deploy

- Untrack .runner (contains registration token), act_runner binary, and nohup.out
- Add gitea-runner sensitive files to .gitignore
- Auto-register runner from env var if .runner is missing
- Switch deploy workflow git pull from HTTP to SSH

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gitea-runner/run.sh

@@ -6,7 +6,17 @@ while ! curl -sf http://localhost:3000 > /dev/null 2>&1; do
     sleep 2
 done
 
-echo "localhost:3000 is up. Starting act_runner daemon..." >&2
+echo "localhost:3000 is up." >&2
 
+if [ ! -f .runner ]; then
+    echo "No .runner file found. Registering runner..." >&2
+    ./act_runner register --no-interactive \
+        --instance http://localhost:3000 \
+        --token "${GITEA_RUNNER_REGISTRATION_TOKEN}" \
+        --name "${GITEA_RUNNER_NAME:-pi-runner}" \
+        --labels self-hosted
+fi
+
+echo "Starting act_runner daemon..." >&2
 exec ./act_runner daemon